ERM: A Pragmatic Bottom-Up Approach (to Parallel the Top-Down)

Recent regulatory trends such as Basel II for fi nancial services and Sarbanes-Oxley (SOX) for publicly traded companieshave heightened the importance of better enterprise risk management (ERM). So have trends like globalization, integrated financial markets, the knowledge economy, and political uncertainty. Today, more than ever, how well you take and manage risks affects your cost of capital.

And yet, with the exception of industries such as banking and insurance, many companies fi nd the notion of ERM foreign and diffi cult to implement. The complexity of ERM at every level is daunting?

»How will you determine the universe of all your risks?
»How will you perform an assessment to prioritize which ones are most important?
»How will you design a system of controls that effectively mitigate the risk?
»How will you make sure the controls are working or your risks are at acceptable levels?
»How will you integrate all of this into the daily functioning of the business?

Change Is the Challenge

Anyone who has tried to initiate and gain adoption for an enterprise-wide program, such as Enterprise or Corporate Performance Management, knows that a key reason for failure is change. A fundamental challenge in implementing ERM is the ability to “sell” and “manage” the necessary change in behavior across the entire organization. Managing risk, like managing cost or revenue, cannot be done from the top alone— it must be “owned” by those closest to its occurrence, i.e. the process owners on the front line where managing risk must become just another part of their job. This paper lays out a pragmatic approach for addressing the challenge of change and establishing successful ERM through a series of bottom-up steps that build on existing functional capabilities. These should not be seen as replacing a top-down approach. They should be seen as acting in parallel, in an iterative, mutually re-adjusting and reenforcing manner.

SOX provides a great starting point for a bottom-up approach. When structured properly, the major investment for SOX compliance can now fi nally yield value far beyond an auditor’s attestation. The Internal Audit and IT departments can then integrate and build on this investment, each bringing longstanding experience for identifying and mitigating risk. Lastly, each Line of Business and its respective business functions also manage risk, which can be incorporated with the others together under one clear mapping. The five bottom-up steps below offer a simple, practical path that ensure that you get to this single viewpoint and that your ERM efforts are successful by leveraging existing strengths and gaining “ownership”
from the frontline.

STEP 1
Use Your 404 Documentation to Create a Common Map Section 404 of the Sarbanes-Oxley legislation created a single, consistent, and broad defi nition of the enterprise in contrast to existing fi nancial, operational, HR, or legal defi nitions. These defi nitions served a more narrow purpose and were therefore
not as comprehensive nor were they usually consistent. Until SOX, there was no “Rosetta Stone” to provide a common, universally applicable map of the business, in terms of organizational entities, transaction processes, systems, people, risks, and their overall relationship to fi nancial accounts. A common map is the foundation for identifying risks in a consistent manner across the enterprise. It also ensures alignment across different regulatory environments, risk types, and process owners who may have to address them.

STEP 2
Build on Your Top-Down, Bottom-Up Risk Assessment The new SEC guidelines and the PCAOB’s  Auditing Standard No. 5 have heightened the awareness for an integrated top-down and bottom-up risk assessment approach to SOX. The opportunity is to rationalize the number of key controls required and streamline their testing based on relative risk. Besides the effi ciency gains this yields in compliance itself, it creates a precedent for how to defi ne risks hierarchically and so be able to “cascade” and target your efforts where they are most valuable, i.e. where “top-level” assessments can be made based on consolidated views of risk and push “down” to lower levels of assessment, monitoring, and action.

STEP 3
Extend and Integrate With Internal Audit Internal Audit is the next practical step in providing a foundation for an enterprisewide view of risks. Internal Auditors have built up a history of assessing operational, financial, and compliance risks across the enterprise for prioritizing and planning annual audits. These risks and audits share the same core elements of the map— companies, locations, and processes. Of course, the shared Audit Universe created by integrating SOX with IA will also result in greater resource effi ciencies and speed.

STEP 4
Align With IT Governance Practices Sarbanes-Oxley requirements highlighted many existing good governance practices in IT, notably those represented by the COBIT framework. Beyond the general computer and application-level controls required for SOX, IT manages multiple risks on a daily basis, such as Business Continuity Planning, Disaster Recovery, and management of businesscritical projects to name a few, but these typically all can fi t into the structure in the same way as the SOX IT controls already have.

STEP 5
Engage and Leverage Your Process Owners and LOBs The upfront disruption SOX had on process owners enlisted to create documentation, identify controls, provide self-assessments, and perform tests has largely been reduced. Initially overwhelmed in terms of both the time and learning curve required, many process owners are now far more aware of fi nancial misstatement risks within their areas. This “culture” of managing risk locally is a valuable asset, where new types of risks can be layered onto the same risk culture and framework. Finally, risk management is more than tracking and assessing threats. When risks are tracked against a common map of the business, it is easier to establish the relationship between business performance and risk, like fl ip sides of the same coin. How these risks are managed is critical to sustaining the goals in revenue growth, expense management, and longterm investment.

The Right Information Is Critical
Underlying each of these steps is the need for a single, integrated view on enterprise- wide risks that is aligned with and supports each of the functional constituencies above. Furthermore, the nature of this information requires a fairly complex structure to effectively capture the fl exible hierarchies and many-to-many relationships it must convey, e.g. risks need to be dynamically categorized, assessed, and tracked by different “families” and “types” and associated to more than one location, process, activity, event, people, systems, and more. Such complexity is best addressed when the information source is based on business intelligence design, because if the information is in right, the job of slicing and dicing out what you need, when you need it, becomes a much more straightforward task that can be captured by your people and delivered into your culture in a much more expedient and powerful way.

Roland Mosimann, CEO and co-founder of Business Intelligence International is an industry pioneer in helping drive initiatives around risk and performance management that are anchored in business intelligence design. In 2004, he drove the launch of the Aline™ platform for on-demand Governance, Risk, and Compliance. He recently coauthored The Performance Manager: Proven Strategies for Turning Information into Higher Business Performance, itself a follow-up to his earlier book The Multidimensional Manager — 24 Ways to Impact Your Bottom Line in 90 Days with more than 400,000 copies printed that remain in use by organizations worldwide today.

About Business Intelligence International (BII): Business Intelligence International (BI International) is a global software and consulting company specializing in the development of Web-based business intelligence solutions to provide GRC +P functionality to companies of all sizes. Since 1996, BI International has provided robust, fl exible, and secure solutions to enable customers worldwide to cost-effectively manage their compliance, risk, and performance initiatives. Leveraging its Aline™ Software as a Service (SaaS) platform, BI International offers a suite of affordable yet powerful and easy-to-use tools that provide a single business intelligence-designed repository of information along with integrated analytics and standard reporting. This allows clients to gain real-time visibility to critical information to identify key issues and drive critical decision making. Visit www.aline4value.com for more information.

Evaluating Internal Control over Financial Reporting

INTRODUCTION

Last year’s passage of Auditing Standard No. 5 (AS-5) seems to have been the Public Company Accounting Oversight Board’s (PCAOB) attempt to swing the Sarbanes Oxley regulatory pendulum back from the process oriented, control-centric, “kitchen sink” approach to one that allowed companies to make intelligent choices around properly mitigating their financial reporting risks via a top-down risk assessment. This in theory should have significantly lowered the amount of work to be done and the costs to be incurred. Furthermore, Auditing Standard 5 also encouraged auditors to rely on the work of others (i.e. documenting and testing key controls) when evaluating the system of internal control, which should have reduced the overall costs of SOX compliance even further.  Unfortunately, in practice, these savings have not been fully realized

In point of fact, external auditors often duplicate their clients’ internally-generated work or perform testing of controls deemed non-key because of management’s inability to clearly and succinctly demonstrate how their own efforts addressed the organization’s financial reporting risks for the relevant assertions of significant accounts and disclosures.  If management is unable do so, then external auditors have no other choice than to exercise their own judgment in determining what work must be done to arrive at an opinion regarding the adequacy of internal control.  Their judgment would include selecting the controls required to achieve financial assertion coverage as well as the nature (inquiry/observation, examination, or re-performance), timing (reporting periods from which samples will be selected), and extent (sample sizes) of the tests to be performed on those controls.  In the current business environment, meeting professional obligations to third-party users of financial statements may impact an auditor’s testing decisions – better safe than sorry.

If an organization truly wants to benefit from AS 5, then it must adopt a systematic, objective approach to evaluating financial reporting and internal control risks and demonstrate management’s testing approach adequately addresses those risks.

CHALLENGES IMPACTING MANAGEMENT’S ABILITY TO EVAULUATE INTERNAL CONTROL OVER FINANCIAL REPORTING

Financial Statement Assertion Coverage

Financial statement assertions are nothing new – Sarbanes Oxley has merely changed them from implicit to overt declarations regarding the balances and disclosures reported by management.  Management must now be able to articulate which assertions should be made about a particular account and what assertions each control provides coverage for.  Inexperience with performing this task or unfamiliarity with the details or nuances of each control by the person performing the “Assertion Sourcing” task can result in four common problems:

1.Failure to document and evaluate all relevant assertions for each significant account.  As a result, it becomes difficult if not impossible to ascertain whether all controls necessary to adequately report on an account are in place.
2.Redundant controls resulting in unnecessary testing due to the difficulty in evaluating the “many to many” relationships of risks, controls, and accounts. 
3.Associating to an assertion the wrong controls, i.e. ones that won’t help meet the assertion.  This situation can result from misunderstanding either the control or the assertion definition.

Claiming a control meets an assertion when it actually covers only a portion.  For instance, the Completeness assertion is really composed of both Completeness and Cutoff; that is, all transactions are recorded in the proper period.  A control like bank reconciliations allows management to assert proper cut-off, but not the completeness of the transactions, which should have been recorded in the General Ledger.
A SUGGESTED METHODOLOGY TO OVERCOME THESE ISSUES

Control Sourcing – Ensuring Assertion Coverage While Optimizing Controls

To overcome these issues, a control-optimization effort can be designed to identify duplicative, overlapping, or non-financial key controls for elimination from testing, as well as any areas where additional controls are needed or testing needs to be enhanced.  However, while critical, the effort is not always simple.  Effective control-optimization requires the ability to evaluate the “many to many” relationships of risks, controls, and accounts and evaluate which control would best enable management to make assertions about significant accounts.  Control optimization also requires understanding which major classes of transactions in each cycle impact those accounts.  Since many organizations utilize spreadsheets to capture the risk and control data attributes/elements, they often find it difficult to evaluate the assertion coverage obtained, because there are too many unique dimensions for Excel to deal with.  Management should consider a true database structure to facilitate “Control Sourcing” to accounts and assertions in order to identify both duplication and control gaps via exposure by analysis.
Risk-Based Testing

Many organizations currently utilize a “one size fits all” approach to control testing.  Control frequency determines sample sizes and the nature of the tests tends to skew towards examination and re-performance.  Internal audit or independent management testers obtain evidence of the control and

Management should consider utilizing an approach which considers the combined effect of Financial Reporting risk (FR) (think Materiality and Impact) and Internal Control risk (IC) (think Likelihood), enabling them to assess the relative significance of controls and potential impact of control failures on Internal Control over Financial Reporting (ICFR) by calculating a numeric score based on objective risk criteria relevant to account balances, assertions, process and controls in a highly defined manner.  No longer would all controls be equal.  Instead, those whose failure could result in a more significant misstatement of the results of operations and required disclosures would receive more robust, objective and timely scrutiny. 

The firm of AC Lordi Consulting has developed such a testing methodology and then taken it one step further. It leverages the information gained during the risk assessment, by                                                                                                                                                                                             recommending the nature (inquiry/observation, examination, re-performance), extent (sample sizes) and timing (period from which samples are drawn) for a test based  on the ICFR  score obtained for the related control. 

For instance, an automated application control, in a well-controlled ERP environment, ensuring the summary of data compiled in the Accounts Receivable sub-ledger is completely and accurately recorded in the General Ledger is much less risky than the activities of an individual summarizing a list of invoices and then data-entering them to the General Ledger via a manual journal entry.  Failure of either control would result in relatively the same financial reporting risk, but the process and control risk of the latter would be significantly higher, So the second control would receive a higher ICFR score based on the Process and controls IC risk contribution This higher score would portend a more severe approach to testing, likely resulting in a larger sample size, performed more often and much closer to the end of the reporting period.

Additionally, this methodology permits an organization to both spread the work more evenly over the year by testing the controls with lower (less risky) ICFR scores earlier in earlier quarters while ensuring management tests controls with higher ICFR scores closer to end of the reporting year and the testing is assigned to the more objective and independent Internal Audit function.

Instead of the usual two-phased approach to testing where the bulk of the testing is performed perhaps nine months into the year, with the remainder done shortly after year-end, and all controls have samples drawn from each of the two periods, management can schedule the tests to occur during less demanding timeframes and Internal Audit can integrate its testing with existing audit responsibilities.

CONCLUSION

Management should take a proactive position in helping frame the conversation regarding testing with the external auditors by providing sufficient documentation of a “top-down, risk-based” evaluation of the risks to providing timely and adequate financial results and disclosures to third-parties.  Their approach should clearly show how the evaluation focused efforts on riskier activities and should aid management in achieving their desired goal of reducing compliance costs by clearly demonstrating to the external auditors familiarity with what could go wrong.  Such an approach should also provide senior management and the Board of Directors with greater assurance that their duties have been properly discharged.
Management’s ability to evaluate its control environment is highly dependent on its ability to properly structure its risk assessment in a way that allows deep visibility into the nature of the framework. Knowing what controls can be omitted and what tests can be simplified amounts to understanding the importance associated to a control and the gaps that exist in meeting the assertions. But with the right methodology, data structures and reporting toolsets, this exercise becomes straightforward and highly cost-effective.

Copyright April 2008 Christopher D Coigne and John Dorsam

SOX 404 Compliance

While completing their first SOX attestation, one of the world’s largest biopharmaceutical outsourcing organizations with operations throughout 43 countries in 56 locations and approximately 6,200 employees, knew that building and maintaining a Sarbanes-Oxley compliance program presented challenges — unearthing and solving the issues that stood in the way of compliance and managing the myriad of spreadsheets and documents that are needed for the task.

In 2005, the Company completed its first year of SOX primarily by performing the tasks in shared services centers in the United States, the United Kingdom and Germany. The Company identified over 1,000 key business controls; remediate and re-tested several hundred key controls and implemented a document control process; tracked remediation; and then tested and re-tested its program.

The company passed the first year of SOX compliance, but at what cost ? Approximately 25,000 internal and external labor hours were needed, and several million dollars were invested.The Company knew it needed to find a better way.